summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorJulian Wiedmann <jwi@linux.ibm.com>2019-08-23 12:29:23 +0300
committerDavid S. Miller <davem@davemloft.net>2019-08-25 02:34:08 +0300
commit292a50e3fc2cf699587ea282e6253e0d6ae3cdc1 (patch)
treec40d909aa89da896c06a1e1924c06c762f3f12d8 /drivers
parentb45ce32135d1c82a5bf12aa56957c3fd27956057 (diff)
downloadlinux-292a50e3fc2cf699587ea282e6253e0d6ae3cdc1.tar.xz
s390/qeth: reject oversized SNMP requests
Commit d4c08afafa04 ("s390/qeth: streamline SNMP cmd code") removed the bounds checking for req_len, under the assumption that the check in qeth_alloc_cmd() would suffice. But that code path isn't sufficiently robust to handle a user-provided data_length, which could overflow (when adding the cmd header overhead) before being checked against QETH_BUFSIZE. We end up allocating just a tiny iob, and the subsequent copy_from_user() writes past the end of that iob. Special-case this path and add a coarse bounds check, to protect against maliciuous requests. This let's the subsequent code flow do its normal job and precise checking, without risk of overflow. Fixes: d4c08afafa04 ("s390/qeth: streamline SNMP cmd code") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Julian Wiedmann <jwi@linux.ibm.com> Reviewed-by: Ursula Braun <ubraun@linux.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/s390/net/qeth_core_main.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index 9c3310c4d61d..6502b148541e 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -4374,6 +4374,10 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
get_user(req_len, &ureq->hdr.req_len))
return -EFAULT;
+ /* Sanitize user input, to avoid overflows in iob size calculation: */
+ if (req_len > QETH_BUFSIZE)
+ return -EINVAL;
+
iob = qeth_get_adapter_cmd(card, IPA_SETADP_SET_SNMP_CONTROL, req_len);
if (!iob)
return -ENOMEM;